@efa-one/sdk 1.14.0 → 1.14.1

package/README.md

@@ -112,6 +112,33 @@ The flat output layout (`backend/` + `frontend/` at the package root) is a
 deliberate choice so that consumers using `moduleResolution: node` (node10) can
 resolve the subpath imports physically — without having to change their tsconfig.
 
+## Quality gates (CI)
+
+Every push and pull request runs the full gate; the same gate also runs as a
+prerequisite job of the release workflow, so a `v*` tag can never publish a state
+that a PR would have rejected.
+
+| Workflow | Runs on | What it enforces |
+|---|---|---|
+| `build-check.yml` | push (`main`, `development`), PR, called by `publish.yml` | `tsc` typecheck (sources **and** `test/` + `scripts/`), Vitest **with coverage thresholds**, ESLint, full `npm run build` (incl. the ESM specifier gate), plus `npm ci` **and** `npm run build` in both `template/` scaffolds |
+| `security.yml` | push, PR, weekly (Mon 06:00 UTC) | `npm audit --audit-level=high` and a copyleft license gate (GPL/AGPL/LGPL) across all three npm directories, Trivy filesystem scan (HIGH/CRITICAL, **including devDependencies** — without that switch Trivy skips them and the scan would be structurally empty here), Trivy misconfig/secret scan (report-only) |
+| `publish.yml` | `v*` tag | tag ↔ `package.json` version match, then npm publish via OIDC trusted publishing |
+| `dependabot.yml` + `dependabot-automerge.yml` | weekly | grouped minor/patch dependency PRs for the SDK, both scaffolds, the scaffold's Docker base images and the GitHub Actions themselves. Auto-merge is present but dormant — see the header comment in the workflow for the three settings that arm it |
+
+Run the blocking gates locally before pushing:
+
+```bash
+./scripts/ci-local.sh    # mirrors build-check.yml + security.yml (Trivy via docker if not installed)
+```
+
+Coverage uses a two-level ratchet (global floor + per-file gates on the modules that
+are deliberately tested); see `vitest.config.ts`. When new tests raise coverage, raise
+the thresholds — never lower them.
+
+**TypeScript is pinned to exactly `6.0.3`.** That is the last JS-based line;
+`typescript-eslint` does not support the native 7.0 compiler and aborts the entire lint
+run under it. Dependabot is configured to never propose a TypeScript major.
+
 ## Versioning
 
 SemVer. Consuming apps pull new versions with `npm update @efa-one/sdk`.

package/frontend/ui/DataTable.js

@@ -1,4 +1,4 @@
-import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useMemo, useState } from 'react';
 import * as DropdownMenu from './DropdownMenu.js';
 import { ChevronDown, ChevronUp, ChevronRight, Settings, EyeOff, Filter, RotateCcw, ArrowUp, ArrowDown, Layers, X } from 'lucide-react';

package/frontend/ui/RecordDialog.js

@@ -1,4 +1,4 @@
-import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useEffect, useState } from 'react';
 import { Pencil } from 'lucide-react';
 import { Dialog, DialogClose } from './Dialog.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@efa-one/sdk",
-  "version": "1.14.0",
+  "version": "1.14.1",
   "description": "Offizielles SDK für efa-one-Apps: Auth/Session, Service-Discovery, Gateway-Client, Audit/Reporting/Mail/Notifications, Permission- und Capability-Registrierung sowie das Frontend-IPC-/i18n-Toolkit.",
   "license": "Apache-2.0",
   "type": "commonjs",
@@ -43,8 +43,10 @@
     "build:backend": "tsc -p tsconfig.backend.json",
     "build:frontend": "tsc -p tsconfig.frontend.json && node scripts/postbuild-frontend.mjs",
     "build": "npm run clean && npm run build:backend && npm run build:frontend",
-    "typecheck": "tsc -p tsconfig.backend.json --noEmit && tsc -p tsconfig.frontend.json --noEmit",
+    "typecheck": "tsc -p tsconfig.backend.json --noEmit && tsc -p tsconfig.frontend.json --noEmit && tsc -p tsconfig.test.json --noEmit",
+    "lint": "eslint src test scripts",
     "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
     "prepublishOnly": "npm run build"
   },
   "publishConfig": {
@@ -103,28 +105,33 @@
     }
   },
   "devDependencies": {
+    "@eslint/js": "^9.39.5",
     "@radix-ui/react-dialog": "^1.1.4",
     "@radix-ui/react-dropdown-menu": "^2.1.4",
     "@radix-ui/react-tooltip": "^1.1.6",
     "@types/express": "^4.17.21",
     "@types/jsonwebtoken": "^9.0.6",
-    "cookie-parser": "^1.4.6",
-    "lucide-react": "^0.468.0",
     "@types/node": "^20.14.0",
     "@types/pg": "^8.11.0",
     "@types/react": "^18.2.46",
+    "@types/react-dom": "^18.2.0",
     "@types/supertest": "^7.2.0",
+    "@vitest/coverage-v8": "^4.1.11",
+    "cookie-parser": "^1.4.6",
+    "eslint": "^9.39.5",
+    "eslint-plugin-react-hooks": "^7.1.1",
     "express": "^4.19.2",
     "i18next": "^23.11.0",
     "i18next-http-backend": "^2.7.3",
     "jsonwebtoken": "^9.0.2",
+    "lucide-react": "^0.577.0",
     "pg": "^8.12.0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
-    "@types/react-dom": "^18.2.0",
     "react-i18next": "^13.5.0",
     "supertest": "^7.2.2",
-    "typescript": "7.0.2",
+    "typescript": "6.0.3",
+    "typescript-eslint": "^8.67.0",
     "vitest": "^4.1.4"
   },
   "engines": {